Cert-manager: potential dos when parsing specially crafted pem inputs

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

输入验证不恰当

cert-manager 输入验证错误漏洞

cert-manager是cert-manager开源的一个证书管理器。将证书和证书颁发者添加为 Kubernetes 集群中的资源类型，并简化了这些证书的获取、续订和使用过程。 cert-manager存在输入验证错误漏洞，该漏洞源于攻击者可以修改cert-manager读取的PEM数据，从而有效地为集群中的cert-manager创建拒绝服务(DoS)向量。

N/A

N/A